annatchijova·annatchijova/SKILLS/control-effectiveness-vs-existence/SKILL.md

control-effectiveness-vs-existence

Skill9 starsChanged 4 months agoLicence not identifiedView on GitHub

Distinguish a control that exists from a control that works — because compliance attests existence ("MFA is enabled") while security requires effectiveness ("MFA that cannot be phished or bypassed on this path"), and the checkbox is passed by the presence of the control, not by its resistance to the threat it names. Use whenever a control is being claimed, audited, or trusted: "we're compliant", "we have MFA / EDR / a WAF / DLP", "we passed SOC2", "the control is in place", "is this control effective", "does this actually stop the attack", "we have a policy for that", "check the box", "audit the controls". Sibling of daubert-defensible-writing (a control claim gets cross-examined) and falsifiable-testing (an effective control survives an actual attempt to defeat it); it separates presence from performance. It does not run the compliance program or write the policy, and never accepts "the control exists" or "we're compliant" as evidence that the threat is stopped.